RedTiger

RedTiger (also known as RedTiger Infostealer) is a type of information-stealing malware (infostealer).
It originated from an open-source red-team / penetration-testing tool.

Originally designed for security testing purposes, the code was later modified by threat actors and turned into real-world malware targeting general users — especially:

• Discord users
• Gamers
• Cryptocurrency users

What is RedTiger?

RedTiger started as a Python-based red-team / penetration-testing tool
that was published as open-source on GitHub for security testing purposes.

However, attackers modified the code and transformed it into an infostealer malware,
capable of collecting sensitive information from infected systems and sending it back to the attacker.

Targets of RedTiger

RedTiger is designed to steal sensitive data from victims’ machines, including:

• Discord tokens (allowing account access without a password)
• Discord account information (email, MFA status, subscription details)
• Saved passwords and browser cookies
• Payment information (e.g., PayPal, stored credit cards)
• Cryptocurrency wallets
• Game-related files (e.g., Roblox)
• Screenshots and webcam images

How the Malware Works

Distribution

RedTiger is commonly disguised as files related to gaming or Discord, such as:

• Mods
• Cheats
• Trainers
• “Free Discord Nitro” tools

Execution Process

Once the malicious file is executed:

1. It scans the system for Discord and browser data files.
2. Extracts tokens, passwords, cookies, and other sensitive information.
3. Performs JavaScript injection into the Discord client to intercept API calls and account activity.
4. Compresses the stolen data.
5. Uploads the data to file-hosting services (e.g., GoFile).
6. Sends download links and victim information to the attacker via Discord webhook.

Evasion and Persistence Features

RedTiger includes techniques to avoid detection, such as:

• Detecting sandbox or debugging environments and terminating itself
• Creating randomly named files and processes
• Establishing persistence to run automatically at system startup (primarily on Windows)

Impact and Risks

• Attackers can fully control a victim’s Discord account, even if the password is changed (if the token is stolen).
• Financial and cryptocurrency assets may be stolen.
• The compromised account may be used for impersonation and further malware distribution.

Prevention Measures

• Do not download or execute files from untrusted sources.
• Enable Multi-Factor Authentication (MFA) on Discord and other services.
• Revoke active sessions/tokens and change passwords immediately if compromise is suspected.
• Install and keep antivirus/anti-malware software updated.
• Clear saved passwords and cookies from browsers regularly.